Endpoint Protection

Need some help with a issue at our facility.  Once you remove a sep client, regardless of version 11.2 to 11.6, the policies set from the server (in our case, usb storage devices have been disabled) remains on the computer. Without turning off the policy of media control on the server, is there a way to remove the client an have the policies removed as well, restoring the computer back to the way it was before SEP was installed?  Thanks for any help you can provide.

-Reg

The policies are stored in the serdef.dat file inside the Symantec Endpoint Protection installation directory.

Default location: - c:\Program Files\Symantec\Symantec Endpoint Protection

Now you said : " Once you remove a sep client, regardless of version 11.2 to 11.6, the policies set from the server (in our case, usb storage devices have been disabled) remains on the computer. "

Questions :

1. How you are removing the SEP?

2. How you are installing it back to the computer?

3. What package are you using?

a. managed

b. unmanaged created from the SEPM

c. Self managed from the SEP installation media or zip file downloaded from http://fileconnect.symantec.com

Hi Jimmy

In response to your questions, we are removing SEP add / remove programs or simply command line msiexec /x product code.  Both remove the product perfectly.

Sadly to say, we will not be installing it back to the pc for a few weeks, possibly months.  Just doing what management says - I like to keep a job :)

The package was created as managed - with all 3 features enabled.

Hope that helps

-Reg

when the product is removed , how would policy work without the components. policies are just xml, .dat files.after the sofware is removed reboot the PC, it should be back to normal.

even after removing the product if its still blocking please post a screen shot..

We were having a similar problem and found using the CleanWipe uninstall utility did the trick. Not sure if it's available via File Connect but you can get it through Tech Support.

If this is critical server machine would recommend to remove Sep manually from the system

http://www.symantec.com/business/support/index?page=content&id=TECH102261&locale=en_US

Try this

Regards

Make sure to take reg back up before making changes to it

Hi Rafeeq

I'll gladly get a screenshot for you on Monday morning when I arrive at work.  Any time we remove a managed SEP client on any pcs, the policies always have stayed behind.  We have to reinstall the SEP client to get the policies off.  I even checked for files or folders after uninstall (manual or automated) an nothing so I'm not sure how the USB storage device policiy is disabled ( i believe it's a registry class that is being changed ), but they stay after the client is removed.  Once again, I'll have that picture for you first thing Monday.

-Reg

That is an excellent and detailed document of how to remove a sep client - gonna prove tough to do on a few hundred pcs. I also need to find out why the policies are staying behind when the client is removed before jumping to manual uninstalls.  thanks for the document though. 

My goal is to find out why / how to get the policies off when sep client is removed.. then go from there on uninstall across the building.

-Reg

It could be that it has disabled the drivers of USB, once you have uninstalled the SEP. do you see devices active in Device Manager..when we manually enable that it works...